web_workflow: reply 409 Conflict instead of 500 when filesystem is write-protected

When the host has CIRCUITPY mounted over USB Mass Storage, the
CircuitPython side of FatFS sees STA_PROTECT on the block device
and f_open(..., FA_WRITE) returns FR_WRITE_PROTECTED.

_write_file_and_reply was lumping this into the generic
'result != FR_OK' branch and replying 500 Internal Server Error,
which looks like a server crash. The mkdir, MOVE, and DELETE paths
in the same file already check FR_WRITE_PROTECTED explicitly and
reply 409 Conflict; this matches PUT to that pattern so clients
can show actionable messages ('eject CIRCUITPY / disable USB MSC')
instead of treating it as an unrecoverable error.

Also tightens the f_size(&active_file) call so it only runs when
f_open actually succeeded -- the previous 'else' branch would read
from an uninitialized FIL on any non-FR_NO_FILE error result.

Reproduction (before): connect a board with web workflow active,
mount CIRCUITPY on the host over USB MSC, save code.py from the
web editor -> the editor reports 'Saving file failed' with no clear
cause and the device returns HTTP 500.

Behavior (after): same flow returns HTTP 409 Conflict; the editor
can map that to a user-facing hint about ejecting CIRCUITPY.

See: circuitpython/web-editor#460